CVE-2026-59243 Details
Description
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
A vulnerability exists in the Apache Airflow FAB provider's Azure Active Directory OAuth login, where the default setting for signature verification is disabled. This flaw allows an attacker to present a forged or unsigned ID token to the OAuth callback, bypassing authentication and gaining access as any user, including those with Admin roles. The issue affects versions of the Apache Airflow FAB provider prior to 3.7.3, with deployments under the default Azure AD OAuth configuration being particularly vulnerable. In contrast, the Authentik path correctly defaults to signature verification enabled.
Users are advised to upgrade to Apache Airflow FAB provider version 3.7.3 or later, which corrects the default signature verification setting to enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/28/10 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/69374 | [email protected] | Patch |
| https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-fab | < 3.7.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |
| Jul 29, 2026 | CVE Modified | CVE |